Good morning, Secret CISO readers! Today's newsletter is packed with some of the most significant cybersecurity stories making headlines.

We start with a shocking revelation already mentioned yesterday: data of 3 billion people (it's about 37.5% of the world population) have been exposed in one of the largest data breaches in history. The breach exposed sensitive information including full names, and the company is now facing a lawsuit. In other news, we share six ways to stop your home security camera from being hacked. With cybercriminals becoming more sophisticated, it's crucial to take steps to protect your home security systems.

We also delve into the recent CrowdStrike class action lawsuit, and the alleged hacking of Donald Trump's campaign by Iran, which resulted in the leak of a 270-page dossier on JD Vance's 'vulnerabilities'. Netflix fans, brace yourselves. The much-awaited 'Arcane' Season 2 episodes have been leaked online following a Netflix breach. This comes alongside a major security breach that has seen some of Netflix's most anticipated upcoming shows and movies leaked.

We also touch on the recent data leak involving crypto wallets that led the FBI to America's most wanted sex-traffic fugitive, and the potential for Cash App users to get a piece of a $15 million class action settlement.

Stay tuned for more updates on data breaches, vulnerabilities, cyber attacks, and more in our weekly cybersecurity newsletter. Stay safe, stay informed!

Data Breaches

1. Data of 3 billion people exposed in one of the largest data breaches in history: In a massive data breach, sensitive information of nearly 3 billion people was exposed. The breach, which is one of the largest in history, revealed full names and other personal details of the victims. Source: YourErie.com
2. Donald Trump's 270-page dossier on JD Vance's 'vulnerabilities' hacked by Iran: Former President Donald Trump's campaign accused Iran of orchestrating a hack and leak operation. The breach resulted in the release of a 270-page dossier on JD Vance's vulnerabilities. Source: Times of India
3. How a Crypto Leak Foiled America's Most Wanted Sex-Traffic Fugitive: Michael Pratt, America's most wanted sex-traffic fugitive, was apprehended after a data leak involving crypto wallets he'd bought years earlier led the FBI to his location in Madrid. Source: Business Insider
4. Gramercy Surgery Center hacked; data leaked on dark web: The Everest Team, a group of threat actors, claimed to have acquired more than 460 GB of data from Gramercy Surgery Center and leaked it on the dark web. Source: DataBreaches.Net
5. U-Haul is handing out $100 checks from $5 million data breach settlement: U-Haul agreed to settle in a $5 million class action lawsuit following a massive data breach. Victims of the breach have only two weeks to claim free money from the settlement. Source: The US Sun

Security Research

1. Northeastern partners with National Science Foundation to launch regional research security center: A new research security center, supported by a $4.9M investment from the NSF, will act as an information hub for the research community, aiming to strengthen the security of research activities and protect intellectual property. Source: Northeastern News
2. South Korea's HD HHI to build Large Test Vessel: Security researcher Eunhyuk Cha is contributing to the research and development of a large test vessel in South Korea, showcasing the importance of international relations and security studies in the field of cybersecurity. Source: Hellenic Shipping News
3. How a cybersecurity researcher befriended, then doxed, the leader of LockBit ransomware gang: Security researcher Jon DiMaggio successfully infiltrated and exposed the leader of the LockBit ransomware gang, highlighting the effectiveness of social engineering in cybersecurity. Source: CyberScoop
4. Aqua Security Researchers Disclose Series of AWS Flaws: Aqua Security has discovered six vulnerabilities in Amazon Web Services' cloud services, underscoring the continuous need for robust cloud security measures. Source: Aqua Security
5. Black Hat 2024: Security researchers warn of the growing threat of AI attacks, which could potentially become lethal. Cybersecurity company HiddenLayer recently highlighted this issue at Black Hat 2024. Source: HiddenLayer

Top CVEs

1. CVE-2024-7589 OpenSSH pre-authentication async signal safety issue: A signal handler in sshd(8) may call a logging function that is not async-signal-safe, leading to a race condition that a determined attacker may exploit to allow unauthenticated remote code execution. This issue is another instance of the problem in CVE-2024-6387 addressed by FreeBSD-SA-24:04.openssh. Source: vulners.com
2. CVE-2024-21879 URL parameter manipulations in Enphase IQ Gateway: Improper neutralization of special elements used in a command ('Command Injection') vulnerability through a URL parameter of an authenticated endpoint in Enphase IQ Gateway allows OS Command Injection. This issue affects Envoy: from 4.x to 8.x. Source: vulners.com
3. CVE-2024-21880 URL parameter manipulations in Enphase IQ Gateway: Similar to CVE-2024-21879, this vulnerability allows OS Command Injection via the URL parameter of an authenticated endpoint in Enphase IQ Gateway. This issue affects Envoy: 4.x. Source: vulners.com
4. CVE-2024-21878 Command Injection in Enphase IQ Gateway: Improper neutralization of special elements used in a command ('Command Injection') vulnerability in Enphase IQ Gateway allows OS Command Injection. This vulnerability is present in an internal script. This issue affects Envoy: from 4.x up to and including 8.x. Source: vulners.com
5. CVE-2024-21877 Insecure File Generation in Enphase IQ Gateway: Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability through a URL parameter in Enphase IQ Gateway allows File Manipulation. The endpoint requires authentication. This issue affects Envoy: from 4.x to 8.0. Source: vulners.com

Final Words

And that's a wrap for today's edition of Secret CISO. As we've seen, the world of cybersecurity is constantly evolving, with new threats and vulnerabilities emerging every day. From massive data breaches to innovative ways to secure your home security camera, it's clear that staying informed is the first step towards staying safe. Remember, knowledge is power. So, don't keep this valuable information to yourself.

Share this newsletter with your friends and colleagues, and help them stay one step ahead of the cyber threats.

After all, in the digital world, we're all in this together. Until next time, stay safe and stay informed.